1.4.1. Security incidents

During the reference period of this report (1 October 2025 to 31 May 2026), ACLED recorded 2 884 security incidents across the country. The highest number of security incidents over this period was recorded in January 2026, with 683 incidents that mainly occurred in Aleppo, Deir Ez-Zor, Hasaka and Sweida.363 The January 2026 peak represents a 77 % increase over the 385 incidents recorded in the previous month364 and coincides with the transitional government’s military campaign that led to its takeover of large swathes of formerly SDF-held territory.365 Following the January 2026 peak, incidents declined by more than half to 283 in February 2026. In March, their number temporarily increased to 330 before falling again to 242 in April and further down to 206 in May 2026. An analysis of ACLED data for the entire period from the fall of Bashar Al-Assad on 9 December 2024 to 31 May 2026 shows peaks of over 600 monthly security incidents in December 2024 (733 incidents) and each of the three first months of 2025 (1 118 incidents in January, 782 in February and 841 in March) and finally again in January 2026. From April to December 2025 and again from February to May 2026, monthly numbers of security incidents largely remained below 500. With the exception of the January 2026 peak, a near-steady decline in incidents could be observed from August 2025 through May 2026.366

Regarding the distribution of incident types during the current reference period, of the 2 884 overall incidents recorded, 822 were coded as battles and 1 081 as explosions/remote violence. About one-third of the incidents (981) were categorised as violence against civilians. During this period, instances of both battles and explosions/remote violence more than doubled between December 2025 and January 2026 (from 120 to 257 and 126 to 281, respectively), while incidents of violence against civilians only increased marginally (from 139 to 145). After January 2026, both battles and instances of violence against civilians largely followed a continuous downward trend, diminishing to around 70 or less in May 2026, respectively. Only explosions/remote violence saw a tangible short-term rise in March 2026 following a decline in February. An analysis of the entire period from 9 December 2024 to 31 May 2026 shows that all three incident types saw peaks in the first quarter of 2025, reflecting the overall incident patterns. Battles saw another peak in July and August 2025368 that coincided with the wave of violence in Sweida involving government military forces, Druze armed factions and tribal militia.369 Since August/September 2025, all three types of incidents saw a largely diminishing trend through May 2026, with the exception of the above-mentioned temporary rise in battles and instances of explosions/remote violence in January 2026.370

Governorate-wise, the highest security incident figures in the current reference period were recorded in Aleppo (513), Deir Ez-Zor (482), Hasaka (336), and Sweida (318). By contrast, the lowest numbers were seen in Tartous (23), Damascus (32), Latakia (55) and Idlib (71). By and large, this could also be observed in the overall period between 9 December 2024 and 31 May 2026, although here, Latakia ranked outside the group of four governorates with the lowest incident numbers371 due to the wave of sectarian violence that struck coastal Syria in March 2025.372

The main actors, coded as appearing as either ‘Actor 1’ or ‘Actor 2’, who were implicated in security incidents during the current reference period were unidentified armed groups (1 110), military and police forces of Syria (902), the SDF (797) and ISIL (213). These actors were involved in around 38 %, 31 %, 28 % and 7 %, respectively, of all 2 884 incidents recorded during the current reference period. These four actors were also the main parties involved in security incidents during the entire period from 9 December 2024 to 31 May 2026. However, during this overall period, a higher number of incidents were attributed to the SDF than to the military and police forces of Syria.374

As for the 981 incidents coded as violence against civilians during the reference period, the main parties involved as either ‘Actor 1’ or ‘Actor 2’ were unidentified armed groups (involved in approximately 45 % of all incidents of this type), the SDF (around 24 %), the military and police forces of Syria (around 9 %) and ISIL (about 3 %). These four actors were also the main parties implicated in incidents of violence against civilians over the period from 9 December 2024 to 30 September 2025. Deadly incidents of violence against civilians during the current reference period included attacks by unknown gunmen targeting Alawites, individuals with perceived links to the former Assad regime and individuals of unspecified profile, as well as killings of civilians, including detainees, by SDF members.375

Further analysis of security incidents at the governorate level can be found in the respective sub-sections of section 2. Security situation and conflict impact on civilians by governorate.